Bundespolizeieinheit 5.2 Virus entfernen (OTL Quick Scan im Text) (erster Beitrag)

Casandria · 13.07.2012, 16:06

Hallo!

Ich habe mir durch einen externen Link auf Facebook den Bundespolizeieinheit 5.2 Virus eingefangen indem ich dazu aufgefordert werde 100 € zu zahlen um die Sperre aufzuheben.
Ich habe bereits Antivir durchlaufen lassen, habe auch das Antivir Rescue System durchlaufen lassen. Keine Beseitigung.
In den normalen Modus kann ich nur ohne Netzkabel. Kann aber ins Internet durch den abgesicherten Modus mit Netzwerktreibern. Sonst schiebt sich dieser Pop-Up davor.
Jetzt habe ich gelesen das das ganze durch OTL beseitigt werden kann.
Ich warne vor: Ich bin ein Pc-Noob. Also nicht ganz aber ich muss erst hinter einige Sachen steigen.
Könntet ihr mir helfen diesen Virus zu beseitigen?
Ich habe den Computer von meiner Mom übernommen.
Nutze ihn selber aber schon seit ca. 3 Monaten

OTL.Txt

Code:

ATTFilter

OTL logfile created on: 13.07.2012 16:44:41 - Run 1
OTL by OldTimer - Version 3.2.54.0     Folder = C:\Users\Babsi\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,50 Gb Total Physical Memory | 2,51 Gb Available Physical Memory | 71,66% Memory free
7,23 Gb Paging File | 6,54 Gb Available in Paging File | 90,37% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 58,59 Gb Total Space | 1,86 Gb Free Space | 3,17% Space Free | Partition Type: NTFS
Drive D: | 397,40 Gb Total Space | 323,97 Gb Free Space | 81,52% Space Free | Partition Type: NTFS
 
Computer Name: BABSI-PC | User Name: Babsi | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.07.13 16:44:37 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Babsi\Downloads\OTL.exe
PRC - [2012.06.23 22:38:07 | 001,535,176 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_3_300_262.exe
PRC - [2012.06.18 08:07:22 | 000,913,888 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.06.23 22:38:07 | 009,459,912 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32_11_3_300_262.dll
MOD - [2012.06.18 08:07:22 | 002,042,848 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2011.03.02 13:40:51 | 000,140,288 | ---- | M] () -- C:\Program Files\WinRAR\rarext.dll
MOD - [2007.01.31 11:56:56 | 000,032,768 | ---- | M] () -- D:\EXPERTool\TBPanelExt.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.06.23 22:38:07 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.06.18 08:07:22 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.06.05 15:17:44 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- D:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.05.09 20:09:07 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.05.09 20:09:07 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.11.22 10:59:30 | 000,018,432 | ---- | M] () [Auto | Stopped] -- C:\Users\Babsi\AppData\LocalLow\StumbleUpon\IE\StumbleUponUpdater.exe -- (StumbleUponUpdater)
SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.02.04 13:10:16 | 000,196,912 | ---- | M] (Nitro PDF Software) [Auto | Stopped] -- C:\Program Files\Nitro PDF\Reader\NitroPDFReaderDriverService.exe -- (NitroReaderDriverReadSpool)
SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\EagleXNt.sys -- (EagleXNt)
DRV - File not found [Kernel | On_Demand | Unknown] --  -- (ajjuvyb4)
DRV - [2012.05.09 20:09:07 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.09 20:09:07 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.03.01 01:59:00 | 010,819,392 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2011.10.11 15:00:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.09.24 17:18:19 | 000,137,344 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\hwpsgt.sys -- (hwpsgt)
DRV - [2011.09.24 17:17:52 | 000,009,472 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\lemsgt.sys -- (lemsgt)
DRV - [2011.08.11 04:06:32 | 000,139,368 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2011.04.16 11:48:46 | 000,639,224 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008.01.21 04:23:26 | 000,045,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tpm.sys -- (TPM)
DRV - [2008.01.21 04:23:20 | 002,225,664 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R)
DRV - [2007.06.27 07:00:58 | 000,046,592 | ---- | M] (Atheros Communications Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\l160x86.sys -- (AtcL001)
DRV - [2007.03.16 11:11:38 | 000,012,256 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TBPanel.sys -- (TBPanel)
DRV - [2006.11.02 09:41:49 | 001,010,560 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)
DRV - [2005.12.22 17:02:22 | 000,051,840 | ---- | M] (REDC) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2005.11.16 20:28:32 | 000,028,928 | ---- | M] (REDC) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\URLSearchHook: {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Program Files\uTorrentBar_DE\prxtbuTor.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3031778
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = www.chiliGREEN.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.startfenster.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 10 C7 59 67 55 E0 CB 01  [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 11 37 7F 16 E2 FD 90 4F BD 65 50 0E B8 81 54 B8  [binary data]
IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - No CLSID value found
IE - HKCU\..\URLSearchHook: {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Program Files\uTorrentBar_DE\prxtbuTor.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - No CLSID value found
IE - HKCU\..\URLSearchHook: {ff88a983-649d-4207-9336-9b999280b436} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1:9421
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultthis.engineName: "SFT_de3 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3031778&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "SFT_de3 Customized Web Search"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.at/"
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.2.0.7165
FF - prefs.js..extensions.enabledItems: {ba14329e-9550-4989-b3f2-9732e92d17cc}:2.7.2.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.5.2
FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:3.2.5.2
FF - prefs.js..extensions.enabledItems: battlefieldplay4free@ea.com:1.0.53.2
FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2851647&SearchSource=2&q="
FF - prefs.js..network.proxy.http: "157.181.228.181"
FF - prefs.js..network.proxy.http_port: 3128
FF - prefs.js..network.proxy.no_proxies_on: "localhost, 127.0.0.1, stealthy.co"
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.type: 0
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@ngm.nexoneu.com/NxGame: C:\ProgramData\NexonEU\NGM\npNxGameeu.dll File not found
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Babsi\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.02.15 21:12:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.06.18 08:07:22 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.09.17 05:41:35 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.06.18 08:07:22 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.09.17 05:41:35 | 000,000,000 | ---D | M]
 
[2011.03.01 11:22:44 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Babsi\AppData\Roaming\mozilla\Extensions
[2012.07.13 15:38:07 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Babsi\AppData\Roaming\mozilla\Firefox\Profiles\uul9qr3c.default\extensions
[2012.05.30 16:08:50 | 000,000,000 | ---D | M] (uTorrentBar_DE Community Toolbar) -- C:\Users\Babsi\AppData\Roaming\mozilla\Firefox\Profiles\uul9qr3c.default\extensions\{c840e246-6b95-475e-9bd7-caa1c7eca9f2}
[2012.06.28 18:54:36 | 000,000,000 | ---D | M] (VideoFileDownload - Download YouTube Videos) -- C:\Users\Babsi\AppData\Roaming\mozilla\Firefox\Profiles\uul9qr3c.default\extensions\plugin@videofiledownload.com
[2012.07.13 15:38:07 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Babsi\AppData\Roaming\mozilla\Firefox\Profiles\uul9qr3c.default\extensions\staged
[2011.12.16 09:08:52 | 000,000,000 | ---D | M] (StumbleUpon) -- C:\Users\Babsi\AppData\Roaming\mozilla\Firefox\Profiles\uul9qr3c.default\extensions\toolbar@stumbleupon.com
[2011.09.27 14:05:10 | 000,000,917 | -H-- | M] () -- C:\Users\Babsi\AppData\Roaming\Mozilla\Firefox\Profiles\uul9qr3c.default\searchplugins\conduit.xml
[2011.12.06 07:07:26 | 000,001,801 | -H-- | M] () -- C:\Users\Babsi\AppData\Roaming\Mozilla\Firefox\Profiles\uul9qr3c.default\searchplugins\search-the-web.xml
[2012.02.19 04:40:11 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2012.05.09 15:46:54 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.06.05 23:10:43 | 000,061,219 | ---- | M] () (No name found) -- C:\USERS\BABSI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UUL9QR3C.DEFAULT\EXTENSIONS\{9AA46F4F-4DC7-4C06-97AF-5035170634FE}.XPI
[2012.06.25 16:58:09 | 000,182,698 | ---- | M] () (No name found) -- C:\USERS\BABSI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UUL9QR3C.DEFAULT\EXTENSIONS\STEALTHYEXTENSION@GMAIL.COM.XPI
[2012.06.18 08:07:22 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.02.15 12:38:38 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012.06.18 08:07:21 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.18 08:07:21 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.06.18 08:07:21 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.18 08:07:21 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.18 08:07:21 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.18 08:07:21 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Reg Error: Value error.) - {167F3711-FDE2-4F90-BD65-500EB88154B8} - C:\Windows\system32\audiosrv32.dll File not found
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (VideoFileDownload) - {82EA3E77-7BD2-4744-A8F2-670770767EC5} - C:\Program Files\OApps\bho_project.dll (VideoFileDownload)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - D:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (uTorrentBar_DE Toolbar) - {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Program Files\uTorrentBar_DE\prxtbuTor.dll (Conduit Ltd.)
O2 - BHO: (FrostWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found
O2 - BHO: (StumbleUpon) - {DB616CFF-D989-48A8-9C85-E2A8D56AB2CA} - C:\Users\Babsi\AppData\LocalLow\StumbleUpon\IE\StumbleUpon.dll (StumbleUpon Inc.)
O3 - HKLM\..\Toolbar: (uTorrentBar_DE Toolbar) - {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Program Files\uTorrentBar_DE\prxtbuTor.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (FrostWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (uTorrentBar_DE Toolbar) - {C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} - C:\Program Files\uTorrentBar_DE\prxtbuTor.dll (Conduit Ltd.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [DAEMON Tools] C:\Program Files\DAEMON Tools\daemon.exe (DT Soft Ltd.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [] C:\Users\Babsi\AppData\Local\Temp\mtokusimispg.exe (Konica Minolta)
O4 - HKCU..\Run: [Akamai NetSession Interface] "C:\Users\Babsi\AppData\Local\Akamai\netsession_win.exe" File not found
O4 - HKCU..\Run: [BitTorrent] "C:\Program Files\BitTorrent\BitTorrent.exe"  /MINIMIZED File not found
O4 - HKCU..\Run: [GAINWARD] D:\EXPERTool\TBPanel.exe (Gainward Co.)
O4 - HKCU..\Run: [NCsoft Launcher] D:\City of Heroes\NCLauncher.exe /Minimized File not found
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - D:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - D:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1D53CD75-7F8A-4434-AB44-58746F4BEC71}: DhcpNameServer = 10.0.0.138
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - D:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Babsi\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Babsi\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.09 20:08:30 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2012.07.09 20:08:09 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2012.07.09 20:00:24 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{D4860C09-6B81-4683-9692-8420AF6A8AC6}
[2012.07.09 20:00:11 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{D993658F-6F60-4DCE-B8E6-BB678CB6B93D}
[2012.07.09 19:22:32 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{5734029F-766F-492B-84F6-E4F2BD1292CA}
[2012.07.08 18:27:27 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{A6550822-AD92-4488-AFBF-541220EA4049}
[2012.07.08 18:27:13 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{11ACCD9A-5E6B-45C1-901B-9D5A11DF3CD5}
[2012.07.06 17:05:22 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{2279744E-6C18-42EC-8528-81219C2CD610}
[2012.07.06 17:05:08 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{F1F04534-81AD-4577-A818-B97F40C7A571}
[2012.07.06 00:40:02 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Core
[2012.07.06 00:39:50 | 000,000,000 | ---D | C] -- C:\Users\Babsi\Documents\Electronic Arts
[2012.07.06 00:38:56 | 000,447,752 | ---- | C] (On2.com) -- C:\Windows\System32\vp6vfw.dll
[2012.07.06 00:38:53 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft WSE
[2012.07.05 23:15:52 | 000,000,000 | ---D | C] -- C:\Program Files\Origin Games
[2012.07.05 23:15:30 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\Origin
[2012.07.05 23:15:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Origin
[2012.07.05 23:14:46 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Roaming\Origin
[2012.07.05 23:14:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
[2012.07.05 23:14:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts
[2012.07.04 07:55:24 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{E7672902-C96B-45EB-AE6A-CAC63D046308}
[2012.07.04 07:55:06 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{08506B22-99E7-4073-B4B9-0E88F6418E26}
[2012.07.03 11:18:12 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{979D8C60-5AE4-4BB2-9B99-F17E977ABAC1}
[2012.07.03 11:17:49 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{38572385-A7E6-4208-8F99-62EEFAE74E23}
[2012.07.02 11:36:14 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{544B23C9-5088-49CF-876E-64DB4158212E}
[2012.07.02 11:36:02 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{8CB6FDAC-9290-4152-91C5-3896CB972E42}
[2012.07.01 18:13:11 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{9F6FD59A-FC4C-4389-BC00-9D2F5E776FAF}
[2012.07.01 18:12:43 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{A0DA58BE-A718-46E7-9C5C-5DF9085E6E00}
[2012.06.30 18:12:14 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{7C913A1C-FE2A-41D0-8EA7-CB80979B4E7F}
[2012.06.30 18:11:36 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{6835F48F-81ED-4381-A6D4-6F44EC4477B3}
[2012.06.30 07:47:13 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{12C49154-066D-4A5D-A27B-E185D4C14746}
[2012.06.29 22:40:13 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{68D287A7-408E-4215-A421-06E65555A68E}
[2012.06.29 22:39:34 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{CED7FB43-6CF4-4C83-918A-5D79ED14EA49}
[2012.06.29 08:30:46 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{9FF49E83-80DC-4822-B75D-EC0EE585E035}
[2012.06.29 08:30:17 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{76CEFD8C-C091-493D-B348-E79F3FB78B6A}
[2012.06.28 20:18:56 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Roaming\Publish Providers
[2012.06.28 20:18:46 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2012.06.28 20:18:44 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Roaming\Sony
[2012.06.28 20:18:44 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\Sony
[2012.06.28 20:18:44 | 000,000,000 | ---D | C] -- C:\Users\Babsi\Documents\My Videos
[2012.06.28 18:55:04 | 000,000,000 | ---D | C] -- C:\Users\Babsi\Documents\Downloads
[2012.06.28 18:54:59 | 000,000,000 | ---D | C] -- C:\Users\Babsi\Documents\MyTorrents
[2012.06.28 18:54:36 | 000,000,000 | ---D | C] -- C:\Program Files\TorrentSearch
[2012.06.28 18:54:36 | 000,000,000 | ---D | C] -- C:\Program Files\OApps
[2012.06.28 18:54:14 | 000,000,000 | ---D | C] -- C:\Program Files\intellidownload
[2012.06.28 15:59:34 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{F34B74A9-0B45-46F9-AF9C-98AC85695946}
[2012.06.28 15:59:10 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{0561D052-E986-49CE-97DB-3E316B8ECFE2}
[2012.06.27 08:08:51 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{E37CC218-81E2-4B52-9127-05660AD5BD61}
[2012.06.27 08:08:32 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{6E626DB5-F13D-469F-98AA-2FD26F8B96D9}
[2012.06.26 08:04:49 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{B4C5DEDE-D742-4D0D-AC40-BDE6ECCBE973}
[2012.06.26 08:04:35 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{943C60BF-92A5-42B5-8B25-356B4325DF08}
[2012.06.25 17:32:20 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Roaming\Audacity
[2012.06.25 14:37:44 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{88E755E3-01C3-425D-9CF1-B0D4197E339E}
[2012.06.25 14:37:24 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{7236C53B-B2C4-425A-B930-02298749F678}
[2012.06.23 22:42:43 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\Macromedia
[2012.06.23 18:14:46 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{C9152DC8-F70E-4379-8A71-A8760285854C}
[2012.06.23 18:14:31 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{CD3DEBB0-1187-4972-94B1-985F7AF07E47}
[2012.06.21 16:58:02 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{51A7230B-EE6C-4365-95CD-225C80C82C16}
[2012.06.21 16:57:51 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{42EEC342-3626-4D19-A69B-03600E5EA7AE}
[2012.06.21 06:52:38 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{B2EB82AC-E9EC-4585-A279-25F8A9662D84}
[2012.06.21 06:52:25 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{24F594C8-1E69-4BE9-B1B5-02AC0B323C4C}
[2012.06.20 08:06:01 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{4887EE10-252D-4DE8-84EE-71718E9AB50A}
[2012.06.20 08:05:42 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{42C8590B-6FC1-469F-82A5-34F1085D8A13}
[2012.06.19 12:01:23 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{B8BB8282-8BE3-4F5C-9098-474B1AC829FD}
[2012.06.19 12:01:02 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{EEFB5D39-15D0-48B7-B348-C671EC1E3023}
[2012.06.18 21:10:50 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{B14429C0-B8D6-4E69-88A9-EFFCC9662065}
[2012.06.18 08:08:23 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{93BB0F24-AC07-4D98-A196-716015C37305}
[2012.06.17 12:19:47 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{5633BA0B-479F-4C75-9BA8-A1644AE4CEEE}
[2012.06.16 21:03:51 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{65D587AD-1BF3-4E66-8887-40F7FD0F24D5}
[2012.06.16 07:34:36 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{BB689BC3-B52C-4446-B8BA-8138C9A468A1}
[2012.06.15 09:24:51 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{A2478BCA-6B35-4722-B520-F2D108CE7D55}
[2012.06.14 21:10:03 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Roaming\OpenOffice.org
[2012.06.14 19:49:31 | 000,000,000 | --SD | C] -- C:\Users\Babsi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.4
[2012.06.14 19:49:00 | 000,000,000 | ---D | C] -- C:\Program Files\OpenOffice.org 3
[2012.06.14 19:32:00 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{C212E2B8-2004-46AC-88F2-154167772DF0}
[2012.06.14 19:31:43 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{EA6102D2-E322-4D95-BB3E-E3306F42E1F5}
[2012.06.14 06:51:06 | 000,000,000 | ---D | C] -- C:\Users\Babsi\AppData\Local\{12535268-98A8-4293-9A67-F5322C462488}
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.13 16:44:39 | 000,002,032 | ---- | M] () -- C:\Users\Babsi\AppData\Local\d3d9caps.dat
[2012.07.13 14:40:00 | 000,653,380 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.07.13 14:40:00 | 000,608,650 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.07.13 14:40:00 | 000,135,362 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.07.13 14:40:00 | 000,111,790 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.07.13 14:32:45 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.09 21:47:54 | 000,005,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.09 21:47:54 | 000,005,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.09 21:47:52 | 000,258,632 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.07.09 19:38:27 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.07.06 01:29:12 | 000,302,224 | ---- | M] () -- C:\Users\Babsi\Desktop\AnalysisLog.sr0
[2012.07.06 00:38:17 | 000,001,833 | ---- | M] () -- C:\Users\Public\Desktop\Die*Sims™*3.lnk
[2012.07.06 00:28:55 | 000,447,752 | ---- | M] (On2.com) -- C:\Windows\System32\vp6vfw.dll
[2012.07.05 23:14:46 | 000,000,480 | ---- | M] () -- C:\Users\Public\Desktop\Origin.lnk
[2012.07.02 11:36:16 | 000,001,133 | ---- | M] () -- C:\Users\Babsi\Desktop\Continue Media Finder Installation.lnk
[2012.06.15 11:13:47 | 000,429,279 | ---- | M] () -- C:\Users\Babsi\Desktop\Rudolf.odt
[2012.06.14 19:49:32 | 000,001,037 | ---- | M] () -- C:\Users\Babsi\Desktop\OpenOffice.org 3.4.lnk
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.07.06 01:24:48 | 000,302,224 | ---- | C] () -- C:\Users\Babsi\Desktop\AnalysisLog.sr0
[2012.07.06 00:38:17 | 000,001,833 | ---- | C] () -- C:\Users\Public\Desktop\Die*Sims™*3.lnk
[2012.07.05 23:14:46 | 000,000,480 | ---- | C] () -- C:\Users\Public\Desktop\Origin.lnk
[2012.07.02 11:36:16 | 000,001,133 | ---- | C] () -- C:\Users\Babsi\Desktop\Continue Media Finder Installation.lnk
[2012.06.14 22:02:26 | 000,429,279 | ---- | C] () -- C:\Users\Babsi\Desktop\Rudolf.odt
[2012.06.14 19:49:32 | 000,001,037 | ---- | C] () -- C:\Users\Babsi\Desktop\OpenOffice.org 3.4.lnk
[2012.04.18 13:52:41 | 000,230,752 | ---- | C] () -- C:\Windows\patchw32.dll
[2012.04.18 13:52:41 | 000,118,176 | ---- | C] () -- C:\Windows\patchw.dll
[2011.10.22 18:36:52 | 000,237,568 | ---- | C] () -- C:\Windows\System32\lame_enc.dll
[2011.10.22 18:36:52 | 000,110,080 | ---- | C] () -- C:\Windows\System32\advd.dll
[2011.10.22 18:36:52 | 000,023,040 | ---- | C] () -- C:\Windows\System32\auth.dll
[2011.09.28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2011.09.24 17:18:19 | 000,137,344 | ---- | C] () -- C:\Windows\System32\drivers\hwpsgt.sys
[2011.09.24 17:17:52 | 000,009,472 | ---- | C] () -- C:\Windows\System32\drivers\lemsgt.sys
[2011.08.11 04:06:32 | 000,007,764 | ---- | C] () -- C:\Windows\cadx2.ini
[2011.08.03 04:31:54 | 000,311,912 | ---- | C] () -- C:\Windows\System32\nvStreaming.exe
[2011.07.13 02:56:01 | 000,000,197 | ---- | C] () -- C:\Windows\System32\MRT.INI
[2011.07.02 14:04:04 | 000,000,093 | -H-- | C] () -- C:\Users\Babsi\AppData\Local\fusioncache.dat
[2011.06.05 06:07:16 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2011.05.31 08:39:50 | 000,058,368 | ---- | C] () -- C:\Windows\System32\bdmpegv.dll
[2011.05.31 08:38:18 | 000,015,360 | ---- | C] () -- C:\Windows\System32\bdmjpeg.dll
[2011.04.12 17:20:38 | 000,001,185 | ---- | C] () -- C:\ProgramData\1217777518
[2011.04.12 17:20:21 | 000,203,776 | -HS- | C] () -- C:\ProgramData\unrar.exe
[2011.04.12 17:20:21 | 000,000,144 | -HS- | C] () -- C:\ProgramData\1757406274
[2011.04.07 20:56:23 | 000,138,056 | -H-- | C] () -- C:\Users\Babsi\AppData\Roaming\PnkBstrK.sys
[2011.03.24 03:17:02 | 000,017,408 | -H-- | C] () -- C:\Users\Babsi\AppData\Local\WebpageIcons.db
[2011.03.13 01:42:57 | 000,000,000 | -H-- | C] () -- C:\Users\Babsi\AppData\Roaming\AVSDVDPlayer.m3u
[2011.03.13 01:40:23 | 000,524,288 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2011.03.13 01:40:23 | 000,139,264 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2011.03.06 07:56:13 | 000,079,872 | -H-- | C] () -- C:\Users\Babsi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.03.03 14:25:46 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011.03.01 14:27:21 | 000,000,552 | -H-- | C] () -- C:\Users\Babsi\AppData\Local\d3d8caps.dat
[2011.03.01 12:51:08 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2011.03.01 12:51:08 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2011.03.01 11:02:36 | 000,002,032 | ---- | C] () -- C:\Users\Babsi\AppData\Local\d3d9caps.dat
 
========== LOP Check ==========
 
[2011.09.06 01:38:48 | 000,000,000 | -H-D | M] -- C:\Users\Babsi\AppData\Roaming\.minecraft
[2011.07.30 00:11:00 | 000,000,000 | -H-D | M] -- C:\Users\Babsi\AppData\Roaming\Artweaver
[2011.09.24 17:24:14 | 000,000,000 | -H-D | M] -- C:\Users\Babsi\AppData\Roaming\Ascaron Entertainment
[2012.06.25 17:32:43 | 000,000,000 | ---D | M] -- C:\Users\Babsi\AppData\Roaming\Audacity
[2011.04.04 23:12:42 | 000,000,000 | -H-D | M] -- C:\Users\Babsi\AppData\Roaming\Azureus
[2011.11.08 11:31:30 | 000,000,000 | -H-D | M] -- C:\Users\Babsi\AppData\Roaming\concept design
[2011.11.04 18:39:28 | 000,000,000 | -H-D | M] -- C:\Users\Babsi\AppData\Roaming\dp3d
[2011.07.11 11:42:20 | 000,000,000 | -H-D | M] -- C:\Users\Babsi\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.07.27 00:18:35 | 000,000,000 | -H-D | M] -- C:\Users\Babsi\AppData\Roaming\FrostWire
[2011.09.27 22:19:12 | 000,000,000 | -H-D | M] -- C:\Users\Babsi\AppData\Roaming\GetRightToGo
[2012.02.23 21:15:12 | 000,000,000 | -H-D | M] -- C:\Users\Babsi\AppData\Roaming\go
[2011.10.02 17:50:50 | 000,000,000 | -H-D | M] -- C:\Users\Babsi\AppData\Roaming\Kalypso Media
[2011.03.01 14:13:39 | 000,000,000 | -H-D | M] -- C:\Users\Babsi\AppData\Roaming\Lionhead Studios
[2011.06.10 19:12:25 | 000,000,000 | -H-D | M] -- C:\Users\Babsi\AppData\Roaming\Nitro PDF
[2011.06.05 06:03:36 | 000,000,000 | -H-D | M] -- C:\Users\Babsi\AppData\Roaming\OpenCandy
[2012.06.14 21:10:03 | 000,000,000 | ---D | M] -- C:\Users\Babsi\AppData\Roaming\OpenOffice.org
[2012.07.05 23:15:52 | 000,000,000 | ---D | M] -- C:\Users\Babsi\AppData\Roaming\Origin
[2012.06.28 20:18:56 | 000,000,000 | ---D | M] -- C:\Users\Babsi\AppData\Roaming\Publish Providers
[2011.03.14 14:11:17 | 000,000,000 | -H-D | M] -- C:\Users\Babsi\AppData\Roaming\Raptr
[2011.11.30 17:28:00 | 000,000,000 | -H-D | M] -- C:\Users\Babsi\AppData\Roaming\RIFT
[2012.06.28 20:18:44 | 000,000,000 | ---D | M] -- C:\Users\Babsi\AppData\Roaming\Sony
[2011.04.14 10:34:12 | 000,000,000 | -HSD | M] -- C:\Users\Babsi\AppData\Roaming\SysWin
[2011.10.03 15:14:00 | 000,000,000 | -H-D | M] -- C:\Users\Babsi\AppData\Roaming\Tropico 3
[2011.10.02 17:52:14 | 000,000,000 | -H-D | M] -- C:\Users\Babsi\AppData\Roaming\Tropico 4
[2012.01.11 20:18:18 | 000,000,000 | -H-D | M] -- C:\Users\Babsi\AppData\Roaming\TS3Client
[2011.12.06 21:09:09 | 000,000,000 | -H-D | M] -- C:\Users\Babsi\AppData\Roaming\Ubisoft
[2011.03.26 21:48:00 | 000,000,000 | -H-D | M] -- C:\Users\Babsi\AppData\Roaming\Unity
[2011.10.23 18:22:33 | 000,000,000 | -H-D | M] -- C:\Users\Babsi\AppData\Roaming\Utherverse
[2012.07.08 20:22:37 | 000,000,000 | ---D | M] -- C:\Users\Babsi\AppData\Roaming\uTorrent
[2012.07.09 20:21:57 | 000,032,510 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:888AFB86

< End of report >

Extras. Txt

Code:

ATTFilter

OTL Extras logfile created on: 13.07.2012 16:44:42 - Run 1
OTL by OldTimer - Version 3.2.54.0     Folder = C:\Users\Babsi\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,50 Gb Total Physical Memory | 2,51 Gb Available Physical Memory | 71,66% Memory free
7,23 Gb Paging File | 6,54 Gb Available in Paging File | 90,37% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 58,59 Gb Total Space | 1,86 Gb Free Space | 3,17% Space Free | Partition Type: NTFS
Drive D: | 397,40 Gb Total Space | 323,97 Gb Free Space | 81,52% Space Free | Partition Type: NTFS
 
Computer Name: BABSI-PC | User Name: Babsi | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- Reg Error: Value error.
https [open] -- Reg Error: Value error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06481521-4459-47F7-883C-0BE33916D74A}" = lport=138 | protocol=17 | dir=in | app=system | 
"{3E6559AD-1D8A-4810-B6C8-FC8D840FE560}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{4CD07833-AA91-46B2-A163-B7B3F827BCAC}" = lport=445 | protocol=6 | dir=in | app=system | 
"{5D2D0E1D-A55A-4387-A889-411199374B52}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{60FBCDCB-D2DF-4F89-B339-A2C680E5642A}" = lport=137 | protocol=17 | dir=in | app=system | 
"{62A98B4C-81F9-40F9-8851-477D1C0E6CC3}" = rport=138 | protocol=17 | dir=out | app=system | 
"{6D81688E-72E1-4338-AB13-7C83DF031990}" = lport=139 | protocol=6 | dir=in | app=system | 
"{84232A1C-937C-468C-9894-77E512CD547F}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{88F9CFF8-284B-440B-B75E-C9E7403C71B7}" = rport=445 | protocol=6 | dir=out | app=system | 
"{94B6C5EF-85C4-4FEB-98C1-14236577FED7}" = rport=137 | protocol=17 | dir=out | app=system | 
"{B932831E-1D4C-4E56-9540-DC46CE54184A}" = rport=139 | protocol=6 | dir=out | app=system | 
"{FB4A315B-9F0D-4371-B311-C3D8E3AAB0E5}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{005DB968-861A-4C2C-B891-98A87C6C168D}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{01CFD788-17DD-4676-98B6-155207CCB44E}" = dir=in | app=c:\windows\system32\config\systemprofile\appdata\roaming\c0f5.tmp | 
"{02EC5E50-B52B-43D2-8204-DAB3879942A9}" = dir=in | app=c:\windows\system32\config\systemprofile\appdata\roaming\c0f5.tmp | 
"{0FB1B35F-B1E3-46C6-B31E-99E0A611ED02}" = protocol=6 | dir=in | app=c:\program files\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 
"{105B4CAE-0C2B-4AF1-BA7E-B2082C5FC637}" = dir=in | app=c:\windows\system32\config\systemprofile\appdata\roaming\c0f5.tmp | 
"{1654BA0D-E6C7-4616-8F9E-186CFC33AC4C}" = protocol=17 | dir=in | app=d:\games\world of warcraft\launcher.patch.exe | 
"{1A415B09-F989-4DCF-9115-C15AF649CA56}" = dir=in | app=c:\windows\imagereswow.exe | 
"{26A99304-8D5F-483E-ACAC-6A97041766B5}" = dir=in | app=c:\windows\spopkwow.exe | 
"{26AB96FB-BE37-45EB-BB9A-2332179AD17D}" = dir=in | app=c:\windows\imagereswow.exe | 
"{2856B679-D5CB-425E-9C00-87C4C11B5C33}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{2FBAE14F-5DA8-4513-9DB3-6DA2248D8870}" = protocol=6 | dir=in | app=d:\games\world of warcraft\launcher.patch.exe | 
"{30DD3EDF-9A2B-4026-89E5-29CDA13AFCC8}" = dir=in | app=c:\windows\spopkwow.exe | 
"{32D8E61A-A490-425A-872C-73F9756410E1}" = dir=in | app=c:\windows\system32\xinput9_1_032.exe | 
"{34A0DFB1-9528-44D9-83BE-F99EFD84D57D}" = protocol=6 | dir=in | app=d:\world of warcraft\launcher.exe | 
"{384E1A2B-A168-41A9-8CDB-469F30C03B55}" = dir=in | app=c:\windows\netprofmwow.exe | 
"{387EFE22-55B4-4F95-871A-5A3041F93406}" = dir=in | app=c:\windows\spopkwow.exe | 
"{3997BD36-E759-4866-970D-AE7EE4D39C6A}" = dir=in | app=c:\windows\netprofmwow.exe | 
"{3ABF4131-D9F0-46AE-886C-4985794ECB70}" = dir=in | app=c:\windows\system32\config\systemprofile\appdata\roaming\c0f5.tmp | 
"{3C6B1FE8-1153-4B8E-952C-7E736F1210D5}" = dir=in | app=c:\windows\system32\config\systemprofile\appdata\roaming\c0f5.tmp | 
"{3F95038D-00C7-437B-8352-DAD3AC478661}" = protocol=17 | dir=in | app=c:\program files\raptr\raptr.exe | 
"{410F5852-3CEE-48D6-8F70-295A12A57360}" = dir=in | app=c:\windows\imagereswow.exe | 
"{419BE0DF-E250-41D5-8527-C326105B4B5D}" = protocol=17 | dir=in | app=d:\star wars-the old republic\launcher.exe | 
"{4665B6F2-7F9F-4CBA-9A03-5940E673D7ED}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{47784BE1-23DC-445F-A2FD-E19EE1757E38}" = protocol=6 | dir=in | app=d:\games\flashpoint\ofdr.exe | 
"{4B278A0E-50B2-4197-B7B7-E7B342EEA349}" = dir=in | app=c:\windows\system32\xinput9_1_032.exe | 
"{4C946048-3AFD-4CC1-BE28-5D149408C79E}" = dir=in | app=c:\windows\system32\config\systemprofile\appdata\roaming\c0f5.tmp | 
"{4DE02EF5-D27B-431A-8836-E5DB7EF5DA06}" = dir=in | app=c:\windows\spopkwow.exe | 
"{54CE90AD-C642-46E6-A963-825673675676}" = protocol=6 | dir=in | app=d:\games\star wars-the old republic\launcher.exe | 
"{580692A8-807F-4295-AFBF-574D94554F2D}" = protocol=6 | dir=in | app=d:\star wars-the old republic\launcher.exe | 
"{620A774F-1796-4064-8214-F59F5757D229}" = protocol=17 | dir=in | app=d:\games\flashpoint\ofdr.exe | 
"{6270C031-C98D-464B-AFE1-4027A81D973D}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe | 
"{63ECDB7F-D762-40AB-82EF-EC4A8B14F685}" = protocol=17 | dir=in | app=d:\world of warcraft\launcher.exe | 
"{65B24187-2E45-43EF-BD87-B7424DFC2955}" = protocol=17 | dir=in | app=d:\games\star wars-the old republic\launcher.exe | 
"{6A58FEE8-AD2D-458B-B470-5FA216376ED6}" = protocol=17 | dir=in | app=c:\users\babsi\appdata\local\akamai\netsession_win.exe | 
"{6ABAB76A-26E1-41E1-A4E5-CCFA9355D899}" = dir=in | app=c:\windows\spopkwow.exe | 
"{6BEA7974-1FD4-4A6B-8451-834367E4C848}" = protocol=6 | dir=in | app=c:\program files\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 
"{7494E393-5305-46AE-8DA3-A030C51DCE7A}" = dir=in | app=c:\windows\system32\config\systemprofile\appdata\roaming\c0f5.tmp | 
"{7AA43043-CD03-40DD-B0F2-DEFFFAC60E6B}" = protocol=17 | dir=in | app=d:\games\world of warcraft\launcher.exe | 
"{7AF82E42-E963-431D-B077-2CCA5AE72195}" = protocol=6 | dir=in | app=c:\program files\raptr\raptr.exe | 
"{80384636-0F43-482C-B21D-79635AF9F122}" = protocol=17 | dir=in | app=d:\world of warcraft\launcher.patch.exe | 
"{8396F323-0D22-402F-85C7-313A1016222A}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{83E7FCFE-BE8C-4D2E-9262-A55CD0B4AD48}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{882F68EA-5746-45D3-A94F-487AE32ADAED}" = dir=in | app=c:\windows\system32\config\systemprofile\appdata\roaming\c0f5.tmp | 
"{8B7F713D-B7D5-4E5B-A56E-84625633B10C}" = dir=in | app=c:\windows\imagereswow.exe | 
"{8D3D6C83-AF3E-4B54-AEEB-26409641F54E}" = protocol=17 | dir=in | app=d:\games\world of warcraft\wow-x.x.x.x-4.0.0.12911-eu-downloader.exe | 
"{965A204F-9C44-429D-A638-9B3D4D2361C1}" = protocol=6 | dir=in | app=d:\games\star wars-the old republic\launcher.exe | 
"{97622131-FD3A-456E-86C4-07923F6DB8AD}" = protocol=17 | dir=in | app=d:\games\data\base\_dbg\bin\release\settlers7r.exe | 
"{994DC537-DBD6-4E85-8467-ED056FAA94DD}" = dir=in | app=c:\windows\system32\xinput9_1_032.exe | 
"{A0BE1B9F-E143-41DA-903E-D6A0DA4B45EF}" = protocol=17 | dir=in | app=d:\games\star wars-the old republic\launcher.exe | 
"{A1D71E00-8FE9-491E-A010-7B6A6A255709}" = protocol=6 | dir=in | app=d:\world of warcraft\launcher.patch.exe | 
"{A25E2320-D03C-4CAB-9E45-9919935BD1C5}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{A2C17470-FAD8-45B7-BBB1-99FFE8588CD5}" = dir=in | app=c:\windows\system32\config\systemprofile\appdata\roaming\c0f5.tmp | 
"{A2F53938-1C44-4E8D-A775-6A6597CE0295}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{A8F3DC17-1D24-423B-9C80-9CEEF0793955}" = protocol=6 | dir=in | app=d:\games\data\base\_dbg\bin\release\settlers7r.exe | 
"{A94ECF37-B2AD-40FF-A6D4-64B9F8D6964F}" = dir=in | app=c:\windows\system32\config\systemprofile\appdata\roaming\c0f5.tmp | 
"{AA946F69-E19F-4D01-9CEC-0207F7E95BD9}" = dir=in | app=c:\windows\netprofmwow.exe | 
"{B11F0051-C6A1-44EB-A327-637613DFC2B1}" = dir=in | app=c:\windows\system32\config\systemprofile\appdata\roaming\c0f5.tmp | 
"{B59EDE46-10A3-4F50-B46D-DF30E4A0EF36}" = dir=in | app=c:\windows\system32\config\systemprofile\appdata\roaming\c0f5.tmp | 
"{B60C32A9-C5F1-4689-952B-9B980316B309}" = protocol=17 | dir=in | app=d:\star wars-the old republic\launcher.exe | 
"{B76E8A09-DFB5-461C-BD03-5B5C25C18018}" = dir=in | app=c:\windows\netprofmwow.exe | 
"{B7CD39DC-6F8C-4BA7-A673-E39535D5E7F4}" = dir=in | app=c:\windows\system32\config\systemprofile\appdata\roaming\c0f5.tmp | 
"{BC73E4EA-AA3C-4456-B3DB-1A5950F131D8}" = protocol=6 | dir=in | app=c:\programdata\nexoneu\ngm\ngm.exe | 
"{C6877459-546E-4CA5-BC49-5166CB032732}" = dir=in | app=c:\windows\netprofmwow.exe | 
"{C6C6D4BA-FC27-45A2-889C-EBBC959516D9}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{C78330BC-DA64-4124-86D3-D0D6E30A337F}" = protocol=17 | dir=in | app=d:\games\vindictus eu\en-eu\nmservice.exe | 
"{D217F9C9-671C-4A55-9728-BB7ABFB11735}" = protocol=17 | dir=in | app=c:\program files\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 
"{D4FB25D6-C367-42A4-B20C-F828B11A05A5}" = protocol=6 | dir=in | app=c:\program files\raptr\raptr_im.exe | 
"{D81E0C95-7F11-4FE0-A9C6-830E29A6CB8C}" = dir=in | app=c:\windows\spopkwow.exe | 
"{DB0FFC2B-6A0A-4406-9DB6-45E92FB157DC}" = dir=in | app=d:\program files\skype\phone\skype.exe | 
"{DB45B147-A636-4946-83AF-409CA8FD66EB}" = protocol=17 | dir=in | app=c:\program files\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 
"{DC082C41-1E0C-4603-949B-A9535F9ECC2E}" = protocol=17 | dir=in | app=d:\games\hotel imperium\iupdate.dll | 
"{DFC4BFFA-3ECF-4C69-A6B1-A86E1ACA3E00}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{DFD6148F-A20C-4C80-971F-41C2B2E1057C}" = protocol=6 | dir=in | app=d:\star wars-the old republic\launcher.exe | 
"{E080587F-A098-44CA-9058-0A8A86ADC8DB}" = protocol=6 | dir=in | app=d:\games\hotel imperium\iupdate.dll | 
"{E4679EF9-60BD-4873-B317-86356C7C7F54}" = protocol=6 | dir=in | app=d:\games\world of warcraft\launcher.exe | 
"{E54C144F-B713-4A78-873B-821F57FF3C3A}" = protocol=17 | dir=in | app=c:\program files\raptr\raptr_im.exe | 
"{E9F521F4-25DD-4CD5-9652-B641ED191636}" = dir=in | app=c:\windows\imagereswow.exe | 
"{EB02DDD4-9B85-4DEC-90A9-9CA2EA820207}" = dir=in | app=c:\windows\imagereswow.exe | 
"{ED46A91C-60A5-4DC9-A27F-B72924BA1044}" = protocol=6 | dir=in | app=d:\games\vindictus eu\en-eu\nmservice.exe | 
"{F131D4F3-701D-4154-BBBC-E59CAE596DFC}" = dir=in | app=c:\windows\netprofmwow.exe | 
"{F7FFD523-D39A-4425-8989-464BB9FCD7FB}" = protocol=17 | dir=in | app=c:\programdata\nexoneu\ngm\ngm.exe | 
"{F8DB8D91-3545-4013-8182-FF5C4E659F48}" = dir=in | app=c:\windows\system32\config\systemprofile\appdata\roaming\c0f5.tmp | 
"{F9FFEF6D-4B5F-4C6F-A821-3D04DA147A89}" = protocol=6 | dir=in | app=d:\games\world of warcraft\wow-x.x.x.x-4.0.0.12911-eu-downloader.exe | 
"{FC0D84E8-863E-4BDB-BC32-E4A3BD53B335}" = protocol=6 | dir=in | app=c:\users\babsi\appdata\local\akamai\netsession_win.exe | 
"{FF95BBC4-0AF9-4D54-BA7E-91497DD6F33D}" = dir=in | app=c:\windows\system32\config\systemprofile\appdata\roaming\c0f5.tmp | 
"TCP Query User{0307D3DB-A80E-4682-8CDC-2D6E4F6E9B57}C:\program files\torrentsearch\easydownload.exe" = protocol=6 | dir=in | app=c:\program files\torrentsearch\easydownload.exe | 
"TCP Query User{051E4D59-239C-497D-8653-131064C7BDCE}D:\games\bin\exefile.exe" = protocol=6 | dir=in | app=d:\games\bin\exefile.exe | 
"TCP Query User{124D3637-6C34-4080-A348-2D4A34970C6B}D:\games\star wars-the old republic\betatest\retailclient\swtor.exe" = protocol=6 | dir=in | app=d:\games\star wars-the old republic\betatest\retailclient\swtor.exe | 
"TCP Query User{14B2E7A9-E31C-4727-982B-30B34CBE4448}D:\games\unreal3\binaries\win32\dcgame.exe" = protocol=6 | dir=in | app=d:\games\unreal3\binaries\win32\dcgame.exe | 
"TCP Query User{256C69FF-0F2C-4965-B95D-EA39CE000A46}D:\cryptic studios\star trek online\live\gameclient.exe" = protocol=6 | dir=in | app=d:\cryptic studios\star trek online\live\gameclient.exe | 
"TCP Query User{4E4245A9-7146-4F0B-BB25-506E375DF433}D:\world of warcraft\backgrounddownloader.exe" = protocol=6 | dir=in | app=d:\world of warcraft\backgrounddownloader.exe | 
"TCP Query User{4FB4C432-E85D-4F45-B836-1117FD2D7F01}D:\world of warcraft\temp\wow-4.2.1.2736-enus-tools-downloader.exe" = protocol=6 | dir=in | app=d:\world of warcraft\temp\wow-4.2.1.2736-enus-tools-downloader.exe | 
"TCP Query User{5698EACE-A803-4223-B1C6-A441D937DB0C}D:\vlc media player\vlc\vlc.exe" = protocol=6 | dir=in | app=d:\vlc media player\vlc\vlc.exe | 
"TCP Query User{5F72FD8B-427D-4A42-958B-DFE07809A297}C:\program files\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files\videolan\vlc\vlc.exe | 
"TCP Query User{735221C7-AA77-4200-A520-BAE15A6B218B}D:\downloads\frostwire\frostwire.exe" = protocol=6 | dir=in | app=d:\downloads\frostwire\frostwire.exe | 
"TCP Query User{7801A214-EED9-445E-AEB8-F278D7638EDB}D:\games\dndclient.exe" = protocol=6 | dir=in | app=d:\games\dndclient.exe | 
"TCP Query User{8AF0F49A-C911-4CFB-A927-B13712F52120}C:\users\babsi\downloads\championsonlinef2p.exe" = protocol=6 | dir=in | app=c:\users\babsi\downloads\championsonlinef2p.exe | 
"TCP Query User{9015CBE4-71A1-4887-B12C-794569861ECC}D:\games\patrizier 2.exe" = protocol=6 | dir=in | app=d:\games\patrizier 2.exe | 
"TCP Query User{B1FF2108-78DE-4653-99B3-E1FDE648C248}D:\spartan.exe" = protocol=6 | dir=in | app=d:\spartan.exe | 
"TCP Query User{BFB01EC2-CB4C-48EB-8875-7726C7E90151}C:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe" = protocol=6 | dir=in | app=c:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe | 
"TCP Query User{C3C595FD-E339-4DE1-A681-9DBABFC0CE2A}D:\star wars-the old republic\launcher.exe" = protocol=6 | dir=in | app=d:\star wars-the old republic\launcher.exe | 
"TCP Query User{C6A5F49E-CB15-4E28-BC6B-842FED466975}D:\users\public\games\cryptic studios\star trek online\live\gameclient.exe" = protocol=6 | dir=in | app=d:\users\public\games\cryptic studios\star trek online\live\gameclient.exe | 
"TCP Query User{D9F3BC94-2D26-49A5-A02F-3CC482360AEF}D:\games\bin\exefile.exe" = protocol=6 | dir=in | app=d:\games\bin\exefile.exe | 
"TCP Query User{DB7597F6-A4A8-4D0E-B5E5-261ADE2FF727}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe | 
"TCP Query User{F6083423-106F-4F2E-B017-76BB0BE1A95F}D:\users\public\games\cryptic studios\champions online\live\gameclient.exe" = protocol=6 | dir=in | app=d:\users\public\games\cryptic studios\champions online\live\gameclient.exe | 
"TCP Query User{F8DFA88E-9BF1-404C-89E2-168D69ADF99E}D:\games\utherverse vww client\utherverse.exe" = protocol=6 | dir=in | app=d:\games\utherverse vww client\utherverse.exe | 
"TCP Query User{FFEF3FE6-D842-493E-B84B-2D22CC12C892}C:\program files\gameforge\nclauncher\nclauncher.exe" = protocol=6 | dir=in | app=c:\program files\gameforge\nclauncher\nclauncher.exe | 
"UDP Query User{075E5281-8DED-421F-B588-FB621A2D37D9}D:\users\public\games\cryptic studios\star trek online\live\gameclient.exe" = protocol=17 | dir=in | app=d:\users\public\games\cryptic studios\star trek online\live\gameclient.exe | 
"UDP Query User{0E5E1AF7-C5B0-4053-88D3-75297BC4A212}D:\games\bin\exefile.exe" = protocol=17 | dir=in | app=d:\games\bin\exefile.exe | 
"UDP Query User{1998CA17-D0D5-4855-BF6E-B8DCCF1D76DA}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe | 
"UDP Query User{1AAAFA06-6331-4DA8-B9F7-FBFA48020059}D:\cryptic studios\star trek online\live\gameclient.exe" = protocol=17 | dir=in | app=d:\cryptic studios\star trek online\live\gameclient.exe | 
"UDP Query User{269A357B-608D-4476-AFCE-6637D90A7742}D:\games\dndclient.exe" = protocol=17 | dir=in | app=d:\games\dndclient.exe | 
"UDP Query User{2A39DFAB-6C00-488D-A104-8707E6B91CB6}D:\games\bin\exefile.exe" = protocol=17 | dir=in | app=d:\games\bin\exefile.exe | 
"UDP Query User{4374DE0D-6159-4A10-A2B9-F1BE3BBAF2B4}D:\world of warcraft\backgrounddownloader.exe" = protocol=17 | dir=in | app=d:\world of warcraft\backgrounddownloader.exe | 
"UDP Query User{4999AB66-B6C1-4703-8582-525DC6FBD1F7}D:\downloads\frostwire\frostwire.exe" = protocol=17 | dir=in | app=d:\downloads\frostwire\frostwire.exe | 
"UDP Query User{63EE7ED1-D6EA-4509-A0D4-401466ED586A}D:\users\public\games\cryptic studios\champions online\live\gameclient.exe" = protocol=17 | dir=in | app=d:\users\public\games\cryptic studios\champions online\live\gameclient.exe | 
"UDP Query User{76E8AEE4-95E2-4FA1-9F02-896025AB4456}C:\program files\gameforge\nclauncher\nclauncher.exe" = protocol=17 | dir=in | app=c:\program files\gameforge\nclauncher\nclauncher.exe | 
"UDP Query User{78825B50-A64E-4642-82CA-B064FD54020D}D:\games\patrizier 2.exe" = protocol=17 | dir=in | app=d:\games\patrizier 2.exe | 
"UDP Query User{83E64C5E-F28D-4EB0-A1B0-E660E7C41373}C:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe" = protocol=17 | dir=in | app=c:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe | 
"UDP Query User{8BF4CE69-016D-4602-82FE-D84408CE5081}D:\games\star wars-the old republic\betatest\retailclient\swtor.exe" = protocol=17 | dir=in | app=d:\games\star wars-the old republic\betatest\retailclient\swtor.exe | 
"UDP Query User{95377FFA-09E8-46D8-87B3-F4C7599987CA}D:\star wars-the old republic\launcher.exe" = protocol=17 | dir=in | app=d:\star wars-the old republic\launcher.exe | 
"UDP Query User{9557965A-CA58-499E-98D4-D9DAF5A3A4D7}D:\world of warcraft\temp\wow-4.2.1.2736-enus-tools-downloader.exe" = protocol=17 | dir=in | app=d:\world of warcraft\temp\wow-4.2.1.2736-enus-tools-downloader.exe | 
"UDP Query User{98466C0D-F2F2-4138-90CE-A4BA46934C42}D:\games\utherverse vww client\utherverse.exe" = protocol=17 | dir=in | app=d:\games\utherverse vww client\utherverse.exe | 
"UDP Query User{BF84AEAD-7877-4F6E-952C-ED4E3E8E4731}D:\spartan.exe" = protocol=17 | dir=in | app=d:\spartan.exe | 
"UDP Query User{CB7E31D5-0A94-4707-8FCA-FE27ED2D9AA3}C:\program files\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files\videolan\vlc\vlc.exe | 
"UDP Query User{D28CB7B2-496E-41CB-9A8C-16A2B4368F8C}D:\vlc media player\vlc\vlc.exe" = protocol=17 | dir=in | app=d:\vlc media player\vlc\vlc.exe | 
"UDP Query User{D589CAFA-248D-4B2C-905F-BB3CC7F95B96}D:\games\unreal3\binaries\win32\dcgame.exe" = protocol=17 | dir=in | app=d:\games\unreal3\binaries\win32\dcgame.exe | 
"UDP Query User{E419F462-33D6-429A-BEC2-A7D999F85C48}C:\program files\torrentsearch\easydownload.exe" = protocol=17 | dir=in | app=c:\program files\torrentsearch\easydownload.exe | 
"UDP Query User{EEDFC3DC-FFCF-44E4-87BE-4F25EF475A48}C:\users\babsi\downloads\championsonlinef2p.exe" = protocol=17 | dir=in | app=c:\users\babsi\downloads\championsonlinef2p.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0A7A1A2A-94BB-49F8-BB48-256F5D9238D0}" = Nitro PDF Reader
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3B11D799-48E0-48ED-BFD7-EA655676D8BB}" = Star Wars: The Old Republic
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C552FD3-2CCD-4E00-AC64-0681DBB3F8B5}" = OpenOffice.org 3.4
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6A9EF6CF-7630-4E33-AE22-7D70F3AF4B05}" = AION Free-To-Play
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7F6D7FD9-648D-4DD9-BB6E-3990C675ECA4}" = NVIDIA PhysX
"{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}" = Microsoft Games for Windows - LIVE Redistributable
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{92482FB3-C05B-41C6-89E7-75D985602A6E}" = System Requirements Lab
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.1) - Deutsch
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 296.10
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 296.10
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 280.19
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.11.0621
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.2.23.3
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D9E52CD1-9DF1-4A8A-9BDC-1E5E53982F2B}" = Black & White® 2
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.9
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira Free Antivirus
"BandiMPEG1" = Bandisoft MPEG-1 Decoder
"Blitz Document_is1" = Blitz Document 4.9.11
"DivX Setup" = DivX-Setup
"InstallShield_{6A9EF6CF-7630-4E33-AE22-7D70F3AF4B05}" = AION Free-To-Play
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 13.0.1 (x86 de)" = Mozilla Firefox 13.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MySSID_is1" = EXPERTool 7.21
"NCLauncher_GameForge" = NC Launcher (GameForge)
"NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver
"Origin" = Origin
"Star Trek Online" = Star Trek Online
"uTorrentBar_DE Toolbar" = uTorrentBar_DE Toolbar
"vfd-ob" = VideoFileDownload
"VLC media player" = VLC media player 1.1.9
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.00 (32-Bit)
"World of Warcraft" = World of Warcraft
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"UnityWebPlayer" = Unity Web Player
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 27.02.2012 02:48:12 | Computer Name = Babsi-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 27.02.2012 14:58:36 | Computer Name = Babsi-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 28.02.2012 06:24:40 | Computer Name = Babsi-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 28.02.2012 16:28:29 | Computer Name = Babsi-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung launcher.exe_SWTOR Launcher, Version 3.1.9.0,
 Zeitstempel 0x4eebd6bc, fehlerhaftes Modul SWTORLaunch.dll_unloaded, Version 0.0.0.0,
 Zeitstempel 0x4f184d7f, Ausnahmecode 0xc0000005, Fehleroffset 0x100b7dac,  Prozess-ID
 0x5e0, Anwendungsstartzeit 01ccf656123b58e3.
 
Error - 28.02.2012 17:25:41 | Computer Name = Babsi-PC | Source = Application Hang | ID = 1002
Description = Programm swtor.exe, Version 1.0.0.0 arbeitet nicht mehr mit Windows
 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
 zu suchen.  Prozess-ID: d08  Anfangszeit: 01ccf6577ba578f3  Zeitpunkt der Beendigung:
 355
 
Error - 29.02.2012 03:24:15 | Computer Name = Babsi-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 29.02.2012 14:36:18 | Computer Name = Babsi-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 01.03.2012 12:40:10 | Computer Name = Babsi-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 01.03.2012 12:45:13 | Computer Name = Babsi-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 01.03.2012 14:26:12 | Computer Name = Babsi-PC | Source = WinMgmt | ID = 10
Description = 
 
[ System Events ]
Error - 09.07.2012 14:08:47 | Computer Name = Babsi-PC | Source = DCOM | ID = 10005
Description = 
 
Error - 13.07.2012 08:32:47 | Computer Name = Babsi-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 09.07.2012 um 21:53:29 unerwartet heruntergefahren.
 
Error - 13.07.2012 08:33:07 | Computer Name = Babsi-PC | Source = DCOM | ID = 10005
Description = 
 
Error - 13.07.2012 08:33:14 | Computer Name = Babsi-PC | Source = DCOM | ID = 10005
Description = 
 
Error - 13.07.2012 08:33:16 | Computer Name = Babsi-PC | Source = DCOM | ID = 10005
Description = 
 
Error - 13.07.2012 08:33:29 | Computer Name = Babsi-PC | Source = DCOM | ID = 10005
Description = 
 
Error - 13.07.2012 08:33:35 | Computer Name = Babsi-PC | Source = DCOM | ID = 10005
Description = 
 
Error - 13.07.2012 08:34:05 | Computer Name = Babsi-PC | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 13.07.2012 08:34:05 | Computer Name = Babsi-PC | Source = Service Control Manager | ID = 7026
Description = 
 
Error - 13.07.2012 08:49:37 | Computer Name = Babsi-PC | Source = DCOM | ID = 10005
Description = 
 
 
< End of report >

Wenn ihr sonst etwas braucht oder ob ich etwas beachten soll teilt mir dies bitte mit

Ich danke jetzt schon vielmals im vorraus für Lösungssvorschläge.

markusg · 14.07.2012, 17:09

hi
kommst du noch an den link? wenn ja, mal als private nachicht an mich

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

Code:

ATTFilter

:OTL
O4 - HKCU..\Run: [] C:\Users\Babsi\AppData\Local\Temp\mtokusimispg.exe (Konica Minolta)
 :Files
C:\Users\Babsi\AppData\Local\Temp\mtokusimispg.exe
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!

Drücke bitte die

+ E Taste.

Öffne dein Systemlaufwerk ( meistens C: )
Suche nun
folgenden Ordner: _OTL und öffne diesen.
Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
Dies wird eine Movedfiles.zip Datei in _OTL erstellen
Lade diese bitte in unseren Uploadchannel
hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus

Casandria · 14.07.2012, 20:25

Code:

ATTFilter

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
C:\Users\Babsi\AppData\Local\Temp\mtokusimispg.exe moved successfully.
========== COMMANDS ==========
 
[EMPTYFLASH]
 
User: All Users
 
User: Babsi
->Flash cache emptied: 229003 bytes
 
User: Default
 
User: Default User
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
 
[EMPTYTEMP]
 
User: All Users
 
User: Babsi
->Temp folder emptied: 14126866958 bytes
->Temporary Internet Files folder emptied: 704903699 bytes
->Java cache emptied: 1490155 bytes
->FireFox cache emptied: 197227653 bytes
->Flash cache emptied: 0 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 401408 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 155676507 bytes
RecycleBin emptied: 7202468 bytes
 
Total Files Cleaned = 14.490,00 mb
 
 
OTL by OldTimer - Version 3.2.54.0 log created on 07142012_205604

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

So, das ist der Bericht.
Leider hat er mir das nicht als kompriemierte Datei gemacht über "Senden an" also hab ich mir Winzip geholt.
Und beim kompriemiren der Datei hat AntiVir gleich gemeldet den Trojaner Ramson.

Was werde ich als nächstes machen müssen?

Weil der Virus wird lange noch nicht weg sein.

Liebe Grüße

So, lasse gerade TuneUp durchrennen.

markusg · 15.07.2012, 14:58

finger weg von tuneup, solche software ist unsinn und kann dem system schaden, deinstaliere sie bitte

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Casandria · 16.07.2012, 19:59

Code:

ATTFilter

ComboFix 12-07-16.01 - Babsi 16.07.2012  20:50:17.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3582.2099 [GMT 2:00]
ausgeführt von:: d:\downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\intellidownload\gunzip.exe
c:\program files\OApps\bhO_project.dll
c:\programdata\1217777518
c:\programdata\1757406274
c:\programdata\SysWoW32
c:\programdata\SysWoW32\_u1656090184v0
c:\programdata\SysWoW32\mu1656090184v4.kwd
c:\programdata\SysWoW32\mu1656090184v5.kwd
c:\programdata\SysWoW32\mu1656090184v6.kwd
c:\programdata\SysWoW32\mu1656090184v7.kwd
c:\programdata\SysWoW32\wu1656090184v0
c:\programdata\SysWoW32\wu1656090184v0.kwd
c:\programdata\SysWoW32\wu1656090184v1.kwd
c:\programdata\SysWoW32\wu1656090184v2.kwd
c:\programdata\SysWoW32\wu1656090184v3.kwd
c:\programdata\unrar.exe
c:\users\Babsi\AppData\Local\assembly\tmp
c:\users\Babsi\AppData\Roaming\syswin
c:\windows\system32\Temp
D:\install.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-06-16 bis 2012-07-16  ))))))))))))))))))))))))))))))
.
.
2012-07-16 18:54 . 2012-07-16 18:54	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-07-15 01:02 . 2012-06-13 13:40	2047488	----a-w-	c:\windows\system32\win32k.sys
2012-07-14 19:32 . 2012-07-14 19:32	--------	d-----w-	c:\users\Babsi\AppData\Roaming\TuneUp Software
2012-07-14 19:32 . 2012-07-14 19:33	--------	d-----w-	c:\programdata\TuneUp Software
2012-07-14 19:32 . 2012-07-14 19:32	--------	d-sh--w-	c:\programdata\{32364CEA-7855-4A3C-B674-53D8E9B97936}
2012-07-14 19:09 . 2012-06-05 16:47	708608	----a-w-	c:\program files\Common Files\System\ado\msado15.dll
2012-07-14 19:09 . 2012-06-05 16:47	1401856	----a-w-	c:\windows\system32\msxml6.dll
2012-07-14 19:09 . 2012-06-05 16:47	1248768	----a-w-	c:\windows\system32\msxml3.dll
2012-07-14 19:08 . 2012-06-04 15:26	440704	----a-w-	c:\windows\system32\drivers\ksecdd.sys
2012-07-14 19:08 . 2012-06-02 00:04	278528	----a-w-	c:\windows\system32\schannel.dll
2012-07-14 19:08 . 2012-06-02 00:03	204288	----a-w-	c:\windows\system32\ncrypt.dll
2012-07-14 19:08 . 2012-05-31 03:41	6762896	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{66DBADD7-0BFF-4D22-93A1-FC45D038FDA2}\mpengine.dll
2012-07-14 18:56 . 2012-07-14 19:21	--------	d-----w-	C:\_OTL
2012-07-09 18:08 . 2012-07-09 18:08	--------	d--h--w-	c:\programdata\Common Files
2012-07-09 18:08 . 2012-07-09 18:11	--------	d-----w-	c:\programdata\MFAData
2012-07-05 22:40 . 2012-07-05 22:40	--------	d-----w-	c:\programdata\EA Core
2012-07-05 22:38 . 2012-07-05 22:28	447752	----a-w-	c:\windows\system32\vp6vfw.dll
2012-07-05 22:38 . 2012-07-05 22:38	--------	d-----w-	c:\program files\Microsoft WSE
2012-07-05 21:15 . 2012-07-05 21:30	--------	d-----w-	c:\program files\Origin Games
2012-07-05 21:15 . 2012-07-05 21:15	--------	d-----w-	c:\users\Babsi\AppData\Local\Origin
2012-07-05 21:15 . 2012-07-05 22:39	--------	d-----w-	c:\programdata\Origin
2012-07-05 21:14 . 2012-07-05 21:15	--------	d-----w-	c:\users\Babsi\AppData\Roaming\Origin
2012-07-05 21:14 . 2012-07-05 21:14	--------	d-----w-	c:\programdata\Electronic Arts
2012-06-28 18:18 . 2012-06-28 18:18	--------	d-----w-	c:\users\Babsi\AppData\Roaming\Publish Providers
2012-06-28 18:18 . 2012-06-28 18:18	--------	d-----w-	c:\users\Babsi\AppData\Roaming\Sony
2012-06-28 18:18 . 2012-06-28 18:18	--------	d-----w-	c:\users\Babsi\AppData\Local\Sony
2012-06-28 16:54 . 2012-07-16 18:53	--------	d-----w-	c:\program files\OApps
2012-06-28 16:54 . 2012-06-28 16:58	--------	d-----w-	c:\program files\TorrentSearch
2012-06-28 16:54 . 2012-07-16 18:53	--------	d-----w-	c:\program files\intellidownload
2012-06-25 15:32 . 2012-06-25 15:32	--------	d-----w-	c:\users\Babsi\AppData\Roaming\Audacity
2012-06-23 20:42 . 2012-06-23 20:42	--------	d-----w-	c:\users\Babsi\AppData\Local\Macromedia
2012-06-21 15:01 . 2012-06-02 22:19	53784	----a-w-	c:\windows\system32\wuauclt.exe
2012-06-21 15:01 . 2012-06-02 22:19	45080	----a-w-	c:\windows\system32\wups2.dll
2012-06-21 15:01 . 2012-06-02 22:19	1933848	----a-w-	c:\windows\system32\wuaueng.dll
2012-06-21 15:01 . 2012-06-02 22:12	2422272	----a-w-	c:\windows\system32\wucltux.dll
2012-06-21 15:01 . 2012-06-02 22:19	35864	----a-w-	c:\windows\system32\wups.dll
2012-06-21 15:01 . 2012-06-02 22:19	577048	----a-w-	c:\windows\system32\wuapi.dll
2012-06-21 15:01 . 2012-06-02 22:12	88576	----a-w-	c:\windows\system32\wudriver.dll
2012-06-21 15:00 . 2012-06-02 13:19	171904	----a-w-	c:\windows\system32\wuwebv.dll
2012-06-21 15:00 . 2012-06-02 13:12	33792	----a-w-	c:\windows\system32\wuapp.exe
2012-06-18 06:07 . 2012-06-18 06:07	770384	----a-w-	c:\program files\Mozilla Firefox\msvcr100.dll
2012-06-18 06:07 . 2012-06-18 06:07	421200	----a-w-	c:\program files\Mozilla Firefox\msvcp100.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-14 22:38 . 2012-04-06 09:24	426184	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2012-07-14 22:38 . 2011-06-11 06:23	70344	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-31 10:25 . 2011-03-01 09:54	237072	------w-	c:\windows\system32\MpSigStub.exe
2012-05-09 18:09 . 2011-10-18 09:53	137928	----a-w-	c:\windows\system32\drivers\avipbb.sys
2012-05-09 18:09 . 2011-10-18 09:53	83392	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2012-05-01 14:03 . 2012-06-13 17:15	180736	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2012-04-23 16:00 . 2012-06-13 17:15	984064	----a-w-	c:\windows\system32\crypt32.dll
2012-04-23 16:00 . 2012-06-13 17:15	98304	----a-w-	c:\windows\system32\cryptnet.dll
2012-04-23 16:00 . 2012-06-13 17:15	133120	----a-w-	c:\windows\system32\cryptsvc.dll
2012-06-18 06:07 . 2011-04-13 00:00	85472	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{c840e246-6b95-475e-9bd7-caa1c7eca9f2}"= "c:\program files\uTorrentBar_DE\prxtbuTor.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{c840e246-6b95-475e-9bd7-caa1c7eca9f2}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c840e246-6b95-475e-9bd7-caa1c7eca9f2}]
2011-05-09 08:49	176936	----a-w-	c:\program files\uTorrentBar_DE\prxtbuTor.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DB616CFF-D989-48A8-9C85-E2A8D56AB2CA}]
2011-11-22 08:59	269824	----a-w-	c:\users\Babsi\AppData\LocalLow\StumbleUpon\IE\StumbleUpon.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{c840e246-6b95-475e-9bd7-caa1c7eca9f2}"= "c:\program files\uTorrentBar_DE\prxtbuTor.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{c840e246-6b95-475e-9bd7-caa1c7eca9f2}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{C840E246-6B95-475E-9BD7-CAA1C7ECA9F2}"= "c:\program files\uTorrentBar_DE\prxtbuTor.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{c840e246-6b95-475e-9bd7-caa1c7eca9f2}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"GAINWARD"="d:\expertool\TBPanel.exe" [2011-08-02 2273608]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2007-04-10 4431872]
"Skytel"="Skytel.exe" [2007-04-04 1822720]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-05-09 348624]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer7"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
.
R3 1394hub;1394 Enabled Hub;c:\windows\System32\svchost.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - TuneUpUtilitiesDrv
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2012-07-16 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-06 22:38]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://isearch.avg.com/?cid={14038E56-2253-4594-83D4-E0196069BFD9}&mid=42c89a57fff347d0a054d16dca82eb1c-2721e51587cfc871fde70c0021627031221bff8e&lang=de&ds=hk011&pr=sa&d=2012-07-14 21:16&v=11.1.0.12&sap=hp
uInternet Settings,ProxyOverride = 127.0.0.1:9421
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - c:\users\Babsi\AppData\Roaming\Mozilla\Firefox\Profiles\uul9qr3c.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3031778&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxps://www.google.at/
FF - prefs.js: network.proxy.http - 157.181.228.181
FF - prefs.js: network.proxy.http_port - 3128
FF - prefs.js: network.proxy.type - 0
user_pref('extensions.autoDisableScopes', 0);user_pref('security.csp.enable', false);user_pref('security.OCSP.enabled', 0);
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{ba14329e-9550-4989-b3f2-9732e92d17cc} - (no file)
URLSearchHooks-{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - (no file)
URLSearchHooks-{ff88a983-649d-4207-9336-9b999280b436} - (no file)
BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{BA14329E-9550-4989-B3F2-9732E92D17CC} - (no file)
WebBrowser-{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - (no file)
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
MSConfigStartUp-Raptr - c:\progra~2\Raptr\raptrstub.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-07-16 20:54
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2898027726-3380410112-3257453159-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*i*n*i*ea\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2898027726-3380410112-3257453159-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:a1,24,ac,58,a0,f4,af,c6,b2,a3,e6,0d,b6,91,6d,4a,f6,d9,55,3a,9a,a9,b2,
   d5,3d,b1,ab,59,80,66,23,d2,4c,60,f4,a0,2c,70,36,eb,38,76,a0,86,3b,36,c0,4e,\
"??"=hex:98,4f,0b,a2,2b,94,7a,d2,60,e7,f1,64,05,29,d4,fd
.
[HKEY_USERS\S-1-5-21-2898027726-3380410112-3257453159-1000\Software\SecuROM\License information*]
"datasecu"=hex:0e,53,2f,0b,db,d2,48,45,67,50,ea,5c,bc,98,dd,16,77,ee,61,5b,6f,
   43,30,2b,9a,8b,ec,25,55,15,5b,00,d9,ce,8e,2b,48,84,a3,ee,dc,12,d1,90,8d,3e,\
"rkeysecu"=hex:fc,01,84,f3,ad,9f,dc,99,f6,4e,69,62,88,14,ea,a4
.
Zeit der Fertigstellung: 2012-07-16  20:56:38
ComboFix-quarantined-files.txt  2012-07-16 18:56
.
Vor Suchlauf: 10 Verzeichnis(se), 17.280.585.728 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 17.043.087.360 Bytes frei
.
- - End Of File - - 13D2F764331D9002755294CDF36BC7B3

So das wäre der Log. TuneUp ist wieder unten^^
Dachte der wär ok weil der auf eurer Seite stand.

Bundespolizeieinheit 5.2 Virus entfernen (OTL Quick Scan im Text) (erster Beitrag)

Log-Analyse und Auswertung: Bundespolizeieinheit 5.2 Virus entfernen (OTL Quick Scan im Text) (erster Beitrag)